This invention relates to the field of data processing systems. More particularly, this invention relates to the field of the building of detection and cleaning mechanisms for use against computer viruses.
It is known to provide systems that detect and remove known computer viruses from computer files infected with those known computer viruses. When a new computer virus is released by a virus author, it generally rapidly comes to the notice of anti-virus system providers. These anti-virus system providers must then analyse the new computer virus to identify distinct characteristics of computer files infected with that computer virus such that they may provide a detection mechanism to their customers. In addition, the anti-virus providers must also analyse the computer files infected with the new computer virus to determine a way of removing the new computer virus from the computer file in question and recovering as much data as possible.
The steps of identifying detection and cleaning techniques are typically performed by an experienced computer programmer in the field of anti-virus systems who is able to analyse an infected computer file to identify the virus portions and develop a detection and cleaning mechanism for the new virus. However, the number of new viruses and variants of existing viruses is increasing such that it is difficult for anti-virus system providers to keep pace with the release of new viruses. Furthermore, steps that can increase the speed with which virus detection and virus cleaning mechanisms can be developed and released to customers are strongly advantageous since a new virus will typically have then spread to a lesser extent and have caused less damage than if the release of the detection and cleaning mechanisms took longer.